iptables ftp connection tracking

[xdnox]

Hi,

Appreciate any advice on iptables with ftp connection tracking.The script

below seem to work fine but I am not sure what am I missing. Did I

comprise any security issue with iptables with regards to ftp and

connection tracking? You notice that I have not use state module to

monitor the connection but still works. Thanks.

---snip---

UNPRIVPORTS="1024:65335"

#Allow FTP traffic (Control)
iptables -A INPUT -p tcp --sport $UNPRIVPORTS --dport 21 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 21 --dport $UNPRIVPORTS -j ACCEPT
#Allow FTP traffic (Data)
iptables -A INPUT -p tcp --sport $UNPRIVPORTS --dport 20 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 20 --dport $UNPRIVPORTS -j ACCEPT

---snip---

Thanks.

Dino

[Lazydog]

I would have just tracked ftp connections with 'ip_conntrack_ftp'. Then there is no need to the rules for port 20 as the ftp conntrack would know and allow this connection. As it stands now anyone could still try to establish a connection on port 20.

[xdnox]

Thank you!